Is is posible to use a custom authentication logic in Keycloak?

Question

I have configured Keycloak with LDAP User Federation. When a user wants to login into an application, he is redirected to the Keycloak login page, enters the uid/pwd and is authenticated using an LDAP bind.

This isn't enough for my requirements since I would like to implement some custom authentication logic, e.g:

public boolean authenticate(String uid, String pwd) {

    //1.- validate against LDAP
    //2.- do some other validations
    return validationResult;
} 

How could I include my own authentication logic into Keycloak?

Answer 1

To add a new authentication mechanism, you implement the Authentication SPI. This is described in the Server Development guide > Authentication SPI section.

Answer 2

You could implement an Authentication SPI and deploy it to Keycloak server, or you could implement the authentication logic inside the custom user provider package if you are implementing user federation without using the default options (this authentication flow would be available only for this particular federated user store in this case).